CVEvulnerability

CVE-2021-20305

8.1 HIGH Published 2021-04-05 Modified 2026-10-14 Official page ↗
Status
Modified
Published
2021-04-05
Last modified
2026-10-14
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-327, CWE-787

Description

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

Affected configurations

• nettle project nettle (< 3.7.2) • fedoraproject fedora 33 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • netapp active iq unified manager • netapp ontap select deploy administration utility • debian debian linux 9.0 • debian debian linux 10.0

Related

Weakness · CWE (2)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-787 Out-of-bounds Write weakness

References